{"id":"aa37cbb0-da36-42cb-a90f-fdf216fc7467","title":"AMSI Disabled via Registry Modification","description":"Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value.\nAnti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.\nAdversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-12-25","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unlikely"],"references":["https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d","https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal","https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/"],"source_path":"rules/windows/registry/registry_set/registry_set_amsi_disable.yml","source_sha256":"7021dcca0aa24dede1e2f4600e033174c6845463b826c5ea4f9a65bdc6edf02e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_amsi_disable.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AMSI Disabled via Registry Modification\nid: aa37cbb0-da36-42cb-a90f-fdf216fc7467\nrelated:\n    - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 # Windows AMSI Related Registry Tampering Via CommandLine\n      type: similar\nstatus: experimental\ndescription: |\n    Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value.\n    Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.\n    Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.\nreferences:\n    - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d\n    - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal\n    - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-12-25\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable'\n        Details: 'DWORD (0x00000000)'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\nregression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: AMSI Bypass - Create AMSIEnable Reg Key\n      technique: T1562.001\n      atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/aa37cbb0-da36-42cb-a90f-fdf216fc7467.json","kind":"sigma"}